I did wonder about whether to put that default in - the only reason I didnt was because the code itself does this:

           use_ssl: @options.fetch(:use_ssl, true),
            s3_port: @options.fetch(:port, 443),
            s3_endpoint: @options.fetch(:host, URI.parse(S3BlobstoreClient::ENDPOINT).host),
 +          ssl_verify_peer: @options.fetch(:ssl_verify_peer, true),
 +          s3_multipart_threshold: @options.fetch(:s3_multipart_threshold, 16_777_216),

I wasn't totally clear why 2 sets of default provisioning are occuring? I guess one is from a BOSH manifest perspective, and another is from the code in isolation (if used outside of a BOSH manifest).
I dont suppose its great practice to have defaults being applied at 2 layers, but the BOSH manifest default will take precidence over the codes own one, so its all cool. 

I'll update the PR shortly.

Cheers, Ryan